Re: [PATCH 1/3] drm/amdgpu: disallow multiple FENCE chunks in one submit

["Christian König" <christian.koenig@amd.com>]

On 8/6/26 06:45, Junrui Luo via B4 Relay wrote:
> amdgpu_cs_pass1() dispatches on chunk_id once per chunk without
> rejecting repeated ids. p->uf_bo is a single-slot field, so a
> submission carrying two AMDGPU_CHUNK_ID_FENCE chunks runs
> amdgpu_cs_p1_user_fence() twice, and the second run overwrites
> p->uf_bo with a freshly referenced BO without dropping the reference
> taken by the first.
> 
> amdgpu_cs_parser_fini() only unrefs the final p->uf_bo, so every FENCE
> chunk but the last leaks a BO reference. The leaked BO outlives handle
> close and process exit.
> 
> Reject duplicate FENCE chunks the same way commit fec5f8e8c6bc
> ("drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit") did
> for p->bo_list.
> 
> Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)")
> Reported-by: Yuhao Jiang <danisjiang@gmail.com>
> Assisted-by: Claude:claude-opus-5
> Cc: stable@vger.kernel.org
> Signed-off-by: Junrui Luo <moonafterrain@outlook.com>

Reviewed-by: Christian König <christian.koenig@amd.com>

Thanks,
Christian.

> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> index 5445f75741b5..9c514cb01096 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> @@ -228,6 +228,10 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p,
>                         if (size < sizeof(struct drm_amdgpu_cs_chunk_fence))
>                                 goto free_partial_kdata;
> 
> +                       /* Only a single user fence is allowed to simplify handling. */
> +                       if (p->uf_bo)
> +                               goto free_partial_kdata;
> +
>                         ret = amdgpu_cs_p1_user_fence(p, p->chunks[i].kdata,
>                                                       &uf_offset);
>                         if (ret)
> 
> --
> 2.51.2
> 
>